Run Containly behind a reverse proxy

For access from outside your own network, put a reverse proxy with TLS in front of Containly, for example Traefik, Caddy or nginx.

Settings in Containly

• Bind the port to the host only: "127.0.0.1:8420:8420" under ports: in docker-compose.yml.
• In .env:

CONTAINLY_SECURE_COOKIES=true
CONTAINLY_TRUST_PROXY=true
CONTAINLY_PUBLIC_URL=https://containly.example.com

CONTAINLY_SECURE_COOKIES=true belongs behind HTTPS only. CONTAINLY_TRUST_PROXY=true makes Containly read the proxy's X-Forwarded-* headers. CONTAINLY_PUBLIC_URL is optional: notification e-mails then link to that address. Restart with docker compose up -d afterwards.

Let WebSockets through

Live logs, stats, the console and deploy output use WebSockets, and the agent on remote hosts connects over WSS. Your proxy must forward WebSocket connections; with nginx that means passing the Upgrade and Connection headers.

Common mistakes

• Black page over HTTP: CONTAINLY_SECURE_COOKIES=true is set, but you open Containly without HTTPS. Set it to false or open it through the proxy with HTTPS.
• Proxy or firewall blocks: since Containly 2.3.0 the app then shows "Containly is not reachable" with the reason, for example "blocked" or "proxy sign-in".

More in the install guide. When you share your proxy config here, replace domains and addresses you do not want to show.